At cybersecurity gathering, the White House steps up charm offensive
Loading...
| SAN FRANCISCO
The contrast couldn't have been sharper听between the Washington insider and the tech executive.听
In San Francisco this week, White House cybersecurity czar听Michael Daniel 鈥 clad in dark听suit, government pin, and a yellow tie decorated with waving flags 鈥 sat across from听Amit Yoran, president of the security firm RSA, who was sporting a tight zip-up workout shirt and听jeans.
Yet the differences between the two 鈥 and between Silicon Valley and Washington 鈥 are far more than just sartorial.听
Mr. Daniel and Mr. Yoran came together for one of the听hundreds of events that took place this week during the RSA Conference, an annual megagathering for the cybersecurity industry. It attracted tens of thousands of professionals from the field, and听also lured听Obama administration officials and Washington policymakers on a concerted听charm offensive to win over business leaders at a time when cybersecurity and digital privacy are attracting a national spotlight.听
Indeed, just this week,听the House of Representatives passed two bills to increase the sharing of cyberthreat intelligence between the government and private sector. Information sharing has recently become a major national priority for President Obama in the wake of major breaches on companies such as Sony Pictures and the health insurer Anthem, and lawmakers have touted the proposals as major moves to protect computer networks and consumer data in a rare bipartisan effort.听
But many within听the cybersecurity industry have greeted听the proposals with deep skepticism.听Some argue such听formal exchanges are unnecessary听in light of the sharing that already goes on within industry. Others are concerned about privacy and protecting customers鈥 information once it gets in government hands, especially in light of the revelations about the National Security Agency's听mass surveillance.听And some companies are concerned they might not get useful information back from the government to help protect their networks in exchange for the information they provide.
So across the country,听Obama administration officials made their case.
鈥淚ncreasing the amount of information flow between the government and the private sector, and between companies in the private sector, is a critical foundational element,鈥 said Daniel on the panel with Yoran, at the event听hosted by security company Invincea and Passcode. 鈥淚t鈥檚 a necessary ... component of getting better at confronting the cyberthreat.鈥
Like many within the security and broader technology industry, Yoran said he doesn't believe听sharing threat听information with the government will be a panacea. Although he said it was a "net positive step in the right direction," he wasn't convinced it would stop security breaches.听鈥淚 don鈥檛 think security breaches are stoppable in the current computing paradigm."
Further separating the industry from Washington, which is often slow to catch up to technology, Yoran echoed a familiar Silicon Valley ethos:听鈥淲e just have to move further, faster.鈥澨
The disconnect between these two camps isn't new, but it has become especially fraught following the leaks from former NSA contractor听Edward Snowden听about the government's bulk collection of communications data. At the same Passcode event where Daniel and Yoran met on stage, one听information security professional asked the assistant attorney general for national security, John Carlin, about how the government plans to 鈥済et more cooperation鈥 from the private sector in light of the Snowden revelations.听
"Well, here I am," Mr. Carlin quipped.听鈥淚t鈥檚 relatively new for someone in this position 鈥 to be out here meeting with private industry."
That outreach won't be limited to handshakes on a cross-country business trip.听The federal government is extending its reach into the tech sector by opening permanent outposts in Silicon Valley. Both the Pentagon and Homeland Security announced plans this week to open offices here.
These bridges to the technology sector certainly suggest a growing realization in Washington that the government needs industry in order to guard against increasingly sophisticated cyberattacks. But听whether the administration's approach bears fruit remains to be seen, especially because of the听complicated legal and technical nature of the issues being considered on Capitol Hill.听
For instance, take the House bills on information sharing. and the authorize private companies to share threat data such as malware signatures, Internet protocol addresses and domain names with other companies and with the federal government. The bills offer organizations liability protection for participating in threat information sharing.
Both bills contain provisions that permit government agencies to exchange听data with each other but not with the National Security Agency or Department of Defense. Also included are provisions that prohibit sharing of users鈥 private information and strict limits on the use of the information for any purpose other than mitigating cyberthreats. Now, the two bills need to be consolidated and sent to the Senate as a single bill.
Industry remains concerned despite some amendments to offer liability and privacy protections in exchange for sharing. If a company knows about a potential threat and doesn't act fast enough, will find itself in legal hot water over a data breach? And what's the upside for security vendors to share their own intelligence about cyberthreats with the government, which could in turn give it to听potential听competitors?听
鈥淲e鈥檙e not looking to cannibalize that, put anyone out of business, or compete,鈥 Phyllis Schneck, the Department of Homeland Security鈥檚 top cybersecurity official, assured the audience of industry professionals at the Passcode event.听鈥淲e want you to grow, we want you to make a lot of money because more money leads to more innovation.鈥
Further complicating听the government's push to get companies to provide more agencies more information听is the upcoming debate over whether to听reauthorize听the听USA Patriot Act; intelligence agencies use听key provisions听set to expire in June to justify mass surveillance programs. The upcoming debate will once again resurface privacy concerns in the tech world and may have implications for the fate of the cybersecurity bills on Capitol Hill.
Even so, the听Obama administration officials who ventured west this week appear determined to leave behind a legacy of new cooperation when it comes to improving cybersecurity.听
As Daniel, the cybersecurity czar, said:听鈥淭he president is fond of saying, 鈥榊es, we鈥檙e in the fourth quarter 鈥 but there鈥檚 a lot of interesting stuff that happens in the fourth quarter.' "听
听